GHSA-FP7W-M676-W7GC social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend Backend

Impact The Vend OAuth2 backend used only the numeric Vend userid as the social-auth UID. When multiple Vend shops authenticate through the same application, users from different shops with the same internal Vend user ID could collide in the social-auth association table. A user from one shop coul...

GHSA-VQ6G-G6C7-5F2J social-auth-core has an Improper Authentication issue

Impact The SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued AuthnRequest. Applications using SAML account association could allow an attacker with a valid account on a trusted IdP to link the attacker's SAML...

social-auth-core has an Improper Authentication issue

Impact The SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued AuthnRequest. Applications using SAML account association could allow an attacker with a valid account on a trusted IdP to link the attacker's SAML...

CVE-2026-18963

CVE-2026-18963 — Keycloak Reset-Credentials Flow Bypass Lab Tổng quan Lab mô phỏng lỗ hổng CVE-2026-18963 CVSS 9.1 trong Keycloak, cho phép kẻ tấn công chiếm quyền tài khoản bất kỳ thông qua bypass xác minh email trong luồng đặt lại mật khẩu. Chỉ sử dụng cho mục đích nghiên cứu bảo mật và giáo dụ...

CVE-2025-58434

CVE-2025-58434 - Flowise unauthenticated account takeover, chained to CustomMCP RCE Two Flowise 3.0.5 issues, chained: 1. CVE-2025-58434 - password-reset token disclosure. POST /api/v1/account/forgot-password returns the target user's tempToken directly in the JSON response. Feed it to POST...

Exploit-For-CVE-2026-18963

CVE-2026-18963 — Keycloak Unauthenticated Account Takeover CVSS 9.1 Critical · Keycloak 26.0.0 – 26.7.1 · Unauthenticated A critical vulnerability in Keycloak's reset-credentials flow that allows an unauthenticated attacker to take over any user account without email verification by chaining two...

CVE-2026-19632-POC

CVE-2026-19632 — TranslatePress Unauthenticated Account Takeover Unauthenticated Account Takeover via Password Reset Link Disclosure Contact TG:@soldout0O 💙 Support the Project If you appreciate my work, consider supporting the project via USDT TRC20: TQBA72kakjCZLnJt8fJYcD7dyQCEpzNtVN...

CVE-2026-19632

TranslatePress Password Reset Link Disclosure to Administrator Account Takeover CVE: CVE-2026-19632 | CVSS: 9.8 Critical Unauthenticated account-takeover via TranslatePress plugin for wordpress. Time from CVE publication to working Day-One PoC: 5 hours, 9 minutes, 40 seconds Up to and including...

POC_CVE-2026-41940

POCCVE-2026-41940 Quick start root@kitploit: python3 pocCVE-2026-41940.py -h Usage examples Scan one host root@kitploit: python3 pocCVE-2026-41940.py -u https://target.example:2086 List accounts after successful chain root@kitploit: python3 pocCVE-2026-41940.py -u https://target.example:2086...

keycloak-CVE-2026-18963

CVE-2026-18963 - Keycloak reset-credentials flow bypass Docker setup for testing Keycloak 26.x versions affected by the reset-credentials flow bypass. The included lab pins Keycloak 26.6.2 , which is in the affected range 26.0 and --username \ --new-password '' \ --allow-loopback-http-cookie...

CVE-2026-18963

Keycloak Reset Path Finder Nuclei template to discover exposed Keycloak reset-credentials endpoints across multiple proxy prefixes, context paths, realm names, and path variations. Summary This template helps identify reachable password reset flows that may be relevant during validation of...

CVE-2026-7567-POC

Description This repository contains a Proof of Concept PoC for CVE-2026-7567. The vulnerability affects Wordpress Temporary Login Plugin = 1.0.0 and allows an attacker to authentication bypass to account takeover. I only developed the exploit/PoC for educational and research purposes. How to use...

CVE-2026-57176

A flaw was found in social-auth-core. An identity binding weakness in the Vend OAuth2 authentication backend allows an authenticated remote attacker to gain unauthorized access to another user's account. Because the backend relies solely on numeric user identifiers without scoping them to specifi...

CVE-2026-57177

A flaw was found in social-auth-core. The LoginRadius authentication backend fails to validate the state parameter during the authentication flow, resulting in a login Cross-Site Request Forgery CSRF vulnerability. A remote attacker could exploit this by tricking a user into completing...

CVE-2026-57175

A flaw was found in social-auth-core. The Security Assertion Markup Language SAML backend accepts authentication responses without verifying that they correspond to a previously issued authentication request. A remote authenticated attacker with a valid account on a trusted Identity Provider IdP...

CVE-2026-61823

The code16 Sharp framework (a Laravel-based CMS/admin interface) is vulnerable to stored cross-site scripting (XSS) in versions prior to 9.22.5 . The root cause is that the rich-text editor's HTML sanitizer allows the srcdoc attribute on iframe elements. While the sanitizer HTML-encodes the inter...

CVE-2026-61823 code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute

code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in the rich-text editor because the HTML sanitizer permits the srcdoc attribute on iframe elements. Although markup...

CVE-2026-13248 Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface

An Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface vulnerability in the web management interface in Honeywell PD45 Industrial Printer version...

CVE-2026-57179

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the partial-pipeline resume mechanism accepted partialtoken as a bearer credential without binding it to the browser session that created it. Applications using resumable partial pipeline steps could all...

CVE-2026-57176

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the Vend OAuth2 backend used only the numeric Vend userid as the social-auth UID. When multiple Vend shops authenticate through the same application, users from different shops with the same internal Ven...